Privacy and retention

This is the independent Mac Studio breeding experiment. formlings.art remains the fixed baseline. The experiment has its own storage, signing identity and beta invitations. “Switch website” is ordinary navigation; it does not transfer access, collections or ratings to the baseline.

We record pseudonymous visits, completed creative actions, failures and request duration for up to 90 days. Request duration includes rendering and is not treated as time spent enjoying artwork. No production data is imported from the baseline.

Explicit favourites and dislikes train a personal contextual bandit and contribute to a shared community bandit. The learner chooses mathematical edits before rendering; it does not score the rendered images. Unmarked images, retained parents and automatic choices are not preference labels.

Feedback is stored with a pseudonymous profile key, mathematical graph, version reference and edit history. We record parent graphs, proposed changes, outcomes and which approach presented each offspring. Canceled staged populations are marked as unpresented. Your profile is linked to this browser’s signed visitor identity. A private, single-use connection link can connect these ratings to another browser using this experiment.

Active feedback expires 180 days after its latest explicit rating. Personal model history, presentation events and feedback events expire 180 days after their recorded timestamp. Mathematical edit records retain graphs and derived seeds without browser capability tokens or owner identifiers. “Reset to Community” keeps artworks and ratings, starts a new personal learning period and excludes earlier ratings from that new personal adjustment. It does not undo contributions already included in community models. The Mac experiment has no configured off-site backup; saved-art retention is described below.

When you create art, the protected service holds an anonymous active session containing the current population, a short generation history, your rankings and control choices, and the private mathematical data needed to render and evolve the work. Mathematical genomes and seeds stay on the protected server; the browser receives rendered images, friendly names and opaque identifiers only.

The current beta normally expires an active session after roughly six hours without activity. That window is an operational setting, not a promise: capacity limits, maintenance, restarts or later configuration changes can end a session sooner. Starting a new population does not guarantee immediate deletion of the abandoned server session; it becomes unreachable from the app and expires through the normal process.

Add to My Collection is a private retention action, not publication. The protected service stores a reference to the exact source generation under a one-way hash of an opaque Collection token. A Collection is limited to 64 artworks. When it is full, the app asks you to remove an item; it never silently removes the oldest artwork.

The current anonymous Collection remains available for up to 180 days after its latest valid Collection use. After that inactivity period, collected-only entries become eligible for deletion under the service's backup and removal process. An artwork with a separate unlisted or published page follows that page's retention rules instead.

The Collection token is held only by this browser. Clearing site data, losing the token or changing device can make the Collection unrecoverable, even before the inactivity period ends. This beta has no account, recovery code or cross-device restoration. Keep named PNG copies of anything important.

Your personal bandit starts from the community model, then learns from your explicit feedback across populations. Random exploration continues alongside learned choices. Profile records use an opaque identifier rather than an account identity or email address.

Reset to Community preserves saved artworks and ratings, while restarting the personal adjustment. A profile connection links ratings only; it does not move a Collection or grant beta access. The beta does not yet provide an account-level data dashboard or a separate immediate-delete endpoint.

Creating a population share or publishing an artwork is a deliberate action. It stores an immutable snapshot of the exact source generation, including private server-side mathematical data, so recipients can view it and create an independent branch. Production shares and publications are designed to survive ordinary restarts. Local development links may instead be temporary.

These links are unlisted, not secret: anyone who obtains one may open or forward it, but it is not eligible for Discover. Publishing to the public Discover catalogue is a separate, explicit confirmation which explains that the image and exact source generation become publicly accessible and listed. Collecting, saving, evolving and downloading never publish an artwork as a side effect. There is no self-service expiry or deletion action for a population share yet.

An artwork publisher receives a private management token on that device. It can be used to Unpublish the artwork page. Unpublishing prevents public access but retains the protected source and audit record. Visitors can use Report on an available publication; a bounded reason and the opaque publication ID are recorded for review.

For recorded creation and export usage, we estimate the country or territory from the connection address using a country-only database on our server. The address is not sent to a geolocation service or stored in this report. We keep only the latest country code alongside the existing browser usage identity; the operator sees country totals, not precise locations. We do not request GPS, city or coordinates. VPNs and travel can affect the estimate. Different browsers or devices can count separately, so these totals do not identify unique people. Unavailable locations remain unknown. Country codes for browsers inactive for 90 days are cleared during routine usage cleanup; backup copies follow the existing backup-retention schedule.

Instagram and other campaign links may carry a short campaign label. The beta records limited aggregate funnel events such as opening an artwork, starting or completing a generation, saving or sharing, and choosing an intended use after collecting or saving. Engagement-event payloads use a versioned event name, signal class and bounded public campaign, publication or generation context. Reports and creator unpublishing are moderation events, not positive engagement. Event payloads exclude genomes, rendered pixels, rankings, free-text, opaque session, preference and Collection tokens, IP addresses, referrers and browser user-agent strings.

Discover uses the named engagement-v1 policy to order deliberately published work. Positive engagement families, confidence, recency, diversity, exposure fairness and editorial Featured placement remain separate. Exact internal scores and moderation records are visible only in the authenticated operator dashboard. Engagement affects Discover presentation and never changes rendering or genetic evolution.

An intended-use or print-ready-interest answer is research only. It is not an order, reservation or payment, and this version collects no card details or email address. Commercial intent is kept separate from artwork popularity and never changes the protected genetic engine.

The app uses essential browser local storage for opaque session, preference and Collection tokens, interface settings, current rankings, the one-time intended-use-question state and any publication-management token issued to that browser. These values help resume the experience but do not contain the mathematical genome.

Browser storage and access are specific to the website address. The permanent singular experiment uses separate local-storage keys and an essential signed visitor cookie, leaving older singular website keys intact. A temporary test link does not automatically transfer its browser state when the address changes. Deleting site data can remove access to a personal profile or Collection even when its records still exist on the Studio.

Formlings does not intentionally set advertising or marketing cookies in this beta. You can remove the device copy through your browser's site-data controls, but doing so may make a session, preferences or an unpublish key or Collection unrecoverable. Removing local storage does not itself erase a durable share, publication or server-side Collection record from the protected service; a Collection instead becomes eligible for expiry under its inactivity rule.

The app renders images and stores its independent database and saved artwork records on Mark’s Mac Studio. Cloudflare provides the public encrypted connection. Cloudflare may process routine request information, including IP address, user agent and request timing, for delivery, security and operational logs. The experiment does not write to the baseline’s Railway stores and does not intentionally copy these request fields into demand-event records.

Beta records are used to provide and secure the service, understand aggregate demand and improve the experience. They are not sold and are not used to build advertising profiles. Opaque identifiers are bearer credentials: keep management tokens private and share population or artwork links only with people you are comfortable giving access to.

• Clear current selections without deleting the population.
• Reset to Community while keeping the population and ratings.
• Remove individual artworks from My Collection.
• Start a fresh population and let the abandoned session expire.
• Remove locally stored tokens and settings using browser controls.
• Report an available artwork publication.
• Unpublish your artwork when this browser still holds its management token.

The beta does not yet offer accounts, a data export, a way to enumerate records belonging to a person, self-service deletion of population shares, or recovery after an anonymous token is lost. Those are known limitations, not promises of future availability. The public beta contact is the current Formlings beta account on Instagram. A legal operator identity and dedicated privacy and support channel must be published before a broader or commercial launch.